fwmon

Monitors ipchains/iptables output in realtime — logs to a file, stdout, and/or tcpdump-format capture logs, and supports running non-root and chrooted. Previously known as "Firestorm Firewall Monitor," despite sharing no code with firestorm. Linux-only — it relies on Linux-specific kernel functionality.

Notes

On Linux 2.4 you'll need the NETLINK iptables target, from a recent enough iptables — most distributions weren't shipping it at the time.

Features

Realtime firewall monitoring
Configurable via iptables and ipchains
Single-line summary output
Full hex/ASCII data dumps
Output to tcpdump (libpcap) files
Output to syslog
Runs chrooted and non-root
Configured entirely on the command line
Buffered output
Log to SQL

Sample output

02-07-01 13:17:48 [eth0] TCP 195.224.53.71:80 -> 192.168.254.3:20239 [AS] ttl=115 len=44
0000 : E..,.&@.s.n...5G 45 00 00 2C E1 26 40 00 73 06 6E D1 C3 E0 35 47
0010 : .....PO.1..,..._ C0 A8 FE 03 00 50 4F 0F 31 E7 F3 2C 1C 01 8A 5F
0020 : `."8.6.......... 60 12 22 38 A3 36 00 00 02 04 05 B4

Downloads

The latest version is 1.1.0.

Version 1.1.0 — source · src rpm · i386 rpm
Version 1.0.11 — source · src rpm · i386 rpm — fixes a permission problem with libpcap files
Version 1.0.10 — source · src rpm · i386 rpm — fixes a long-standing crash bug
Version 1.0.9 — source · src rpm · i386 rpm
Version 1.0.8 — source · src rpm · i386 rpm
Version 1.0.7 — source · src rpm · i386 rpm — has a remote DoS security flaw
Version 1.0.6 — source · src rpm · i386 rpm

TODO

Expand syslog support
Allow printf-style specification of output
Use firestorm plugins to do packet decode
Log to other packet dump formats (not aware of any)

Notes

Features

Sample output

Downloads

TODO

License